-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) The getDivUUID method used unsanitized parameter names in HTML element IDs, which could lead to DOM-based XSS. 2) The Jelly template directly rendered the parameter name in the UI title without escaping, allowing direct script injection. The commit patches both vectors: sanitizing the ID generation and escaping the title output. Both locations handle user-controlled input (parameter names) and were missing critical output encoding, making them clear XSS vectors.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.tools:git-parameter | maven | <= 0.9.11 | 0.9.12 |